Your first audit

The Northline Process sample has three plants (Tulsa, Fresno, Savannah) with different addressing and the same zone and rule names. It loads when the app opens.

1. Review. Start with the current verdict, then click Review highest risk.
2. Zone map. Rows are the source level, columns the destination. Warm cells are violations with live sessions. Click a count to see the sessions behind it.
3. Violations. Work the observed queue first. Each finding shows the sessions, matching rules and whether it is a priority trap.
4. Remediation. Open the change plan for the office-to-HMI trap and follow its steps in order.
5. Change package. Every change with its risk, CLI, web steps, verification and rollback.
6. Audit report. Print it, export it as Word, or export every deliverable as one .zip, each document in Word and markdown.

Your own plant

1. Send the evidence request to the client’s engineer.
2. Check the returned files’ SHA-256 against the engineer’s message.
3. Drop the configuration and traffic log on Evidence setup: Panorama or PAN-OS XML and CSV, a FortiGate backup and its FortiGate or FortiAnalyzer logs, an ASA running config and its syslog, an FMC export and the FTDs’ syslog, or a Check Point export and its logs.
4. Correct the Purdue level and target security level for every zone. A wrong mapping gives wrong findings.
5. Follow Review, Violations, Remediation, Audit report.
6. Record what you saw on site that the evidence cannot show under Observations, and reword or re-rate a finding under Your wording on its evidence panel.

Set your firm up once under Data → Firm profile: name, logo, address, rate card, default frameworks, naming and proposal terms. Every new engagement starts from it.

Save the engagement to resume later. The file contains customer data, so handle it like the evidence, or add a passphrase on Evidence setup to encrypt it.